The examples below show the plaintext key “ TEST ” to decrypt encoded hexadecimal strings ( jUtils.decrypt ( ) ) .


These encoded strings contain the new URL addresses not seen in older versions of FakeSpy .


Comparing strings from an old FakeSpy sample to a new one .


WHO IS BEHIND FAKESPY ’ S SMISHING CAMPAIGNS ?


The Cybereason Nocturnus team suspects that the malware operators and authors are Chinese speakers .


Our findings , along with previous research , indicates that the threat actor behind these recent campaigns is likely a Chinese group dubbed “ Roaming Mantis ” .


Roaming Mantis is believed to be a Chinese threat actor group first discovered in April 2018 that has continuously evolved .


In the beginning , this threat group mainly targeted Asian countries .


Now , they are expanding their activity to audiences all around the world .


As part of their activities , they are known for hijacking DNS settings on Japanese routers that redirect users to malicious IP addresses , creating disguised malicious Android apps that appear as popular apps , stealing Apple ID credentials by creating Apple phishing pages , as well as performing web crypto mining on browsers .


CONNECTION TO CHINA Chinese server infrastructure : FakeSpy applications send stolen information to C2 domains with .club TLDs and URLs ending with /servlet/ [ C2 Command ] ( mentioned above in the “ Stealing Sensitive Information ” section ) .


All of these domains are registered to ‘ Li Jun Biao ’ on Bizcn , Inc , a Chinese Internet application service provider .


Chinese language traces in the code : During the investigation , the Cybereason Nocturnus team discovered code artifacts that may indicate Chinese threat actors .


For example , we found several suspicious strings written in the Chinese language in a function called isNetworkAvailable , previously discussed in this blog : An almost identical function is mentioned in an earlier research , that ties FakeSpy and other malware to the Roaming Mantis group .


Chinese APK names : Some of FakeSpy ’ s APK package names contain anglicized Chinese ( Mandarin ) words that might be related to Chinese songs and lyrics , food , provinces , etc .


CONCLUSIONS FakeSpy was first seen in October 2017 and until recently mainly targeted East Asian countries .


Our research shows fresh developments in the malware ’ s code and sophistication , as well as an expansion to target Europe and North America .


This mobile malware masquerades as legitimate , trusted postal service applications so that it can gain the users trust .


Once it has been installed , it requests permissions from the user so that it can steal sensitive data , manipulate SMS messages , and potentially infect contacts of the user .


The malware now targets more countries all over the world by masquerading as official post office and transportation services apps .


These apps appear legitimate due to their app logo , UI appearance , and redirects to the carrier webpage -- all luring end users to believe it ’ s the original one .


In this blog , we showed that the threat actor behind the recent FakeSpy campaign is a Chinese-speaking group called “ Roaming Mantis ” known to operate mainly in Asia .


It is interesting to see that the group has expanded their operation to other regions , such as the United States and Europe .


The malware authors seem to be putting a lot of effort into improving this malware , bundling it with numerous new upgrades that make it more sophisticated , evasive , and well-equipped .


These improvements render FakeSpy one of the most powerful information stealers on the market .


We anticipate this malware to continue to evolve with additional new features ; the only question now is when we will see the next wave .


First Twitter‑controlled Android botnet discovered Detected by ESET as Android/Twitoor , this malware is unique because of its resilience mechanism .


Instead of being controlled by a traditional command-and-control server , it receives instructions via tweets .


24 Aug 2016 - 02:05PM Android/Twitoor is a backdoor capable of downloading other malware onto an infected device .


It has been active for around one month .


This malicious app , detected by ESET as a variant of Android/Twitoor.A , can ’ t be found on any official Android app store – it probably spreads by SMS or via malicious URLs .


It impersonates a porn player app or MMS application but without having their functionality .


After launching , it hides its presence on the system and checks the defined Twitter account at regular intervals for commands .


Based on received commands , it can either download malicious apps or switch the C & C Twitter account to another one .


“ Using Twitter instead of command-and-control ( C & C ) servers is pretty innovative for an Android botnet. ” “ Using Twitter instead of command-and-control ( C & C ) servers is pretty innovative for an Android botnet , ” says Lukáš Štefanko , the ESET malware researcher who discovered the malicious app .


Malware that enslaves devices to form botnets needs to be able to receive updated instructions .


That communication is an Achilles heel for any botnet – it may raise suspicion and , cutting the bots off is always lethal to the botnet ’ s functioning .


Additionally , should the command-and-control ( C & C ) servers get seized by the authorities , it would ultimately lead to disclosing information about the entire botnet .


To make the Twitoor botnet ’ s communication more resilient , botnet designers took various steps like encrypting their messages , using complex topologies of the C & C network – or using innovative means for communication , among them the use of social networks .


“ These communication channels are hard to discover and even harder to block entirely .


On the other hand , it ’ s extremely easy for the crooks to re-direct communications to another freshly created account , ” explains Štefanko .


In the Windows space , Twitter , founded in 2006 , was first used to control botnets as early as in 2009 .


Android bots have also already been found being controlled via other non-traditional means – blogs or some of the many cloud messaging systems like Google ’ s or Baidu ’ s – but Twitoor is the first Twitter-based bot malware , according to Štefanko .


“ In the future , we can expect that the bad guys will try to make use of Facebook statuses or deploy LinkedIn and other social networks ” , states ESET ’ s researcher .


Currently , the Twitoor trojan has been downloading several versions of mobile banking malware .


However , the botnet operators can start distributing other malware , including ransomware , at any time warns Štefanko .


“ Twitoor serves as another example of how cybercriminals keep on innovating their business , ” Stefanko continues .


“ The takeaway ?


Internet users should keep on securing their activities with good security solutions for both computers and mobile devices. ” Hashes : E5212D4416486AF42E7ED1F58A526AEF77BE89BE A9891222232145581FE8D0D483EDB4B18836BCFC AFF9F39A6CA5D68C599B30012D79DA29E2672C6E Insidious Android malware gives up all malicious features but one to gain stealth ESET researchers detect a new way of misusing Accessibility


Service , the Achilles ’ heel of Android security 22 May 2020 - 03:00PM ESET researchers have analyzed an extremely dangerous Android app that can perform a host of nefarious actions , notably wiping out the victim ’ s bank account or cryptocurrency wallet and taking over their email or social media accounts .


Called “ DEFENSOR ID ” , the banking trojan was available on Google Play at the time of the analysis .


The app is fitted with standard information-stealing capabilities ; however , this banker is exceptionally insidious in that after installation it requires a single action from the victim – enable Android ’ s Accessibility Service – to fully unleash the app ’ s malicious functionality .


The DEFENSOR ID app made it onto the heavily guarded Google Play store thanks to its extreme stealth .


Its creators reduced the app ’ s malicious surface to the bare minimum by removing all potentially malicious functionalities but one : abusing Accessibility Service .


Accessibility Service is long known to be the Achilles ’ heel of the Android operating system .


Security solutions can detect it in countless combinations with other suspicious permissions and functions , or malicious functionalities – but when faced with no additional functionality nor permission , all failed to trigger any alarm on DEFENSOR ID .


By “ all ” we mean all security mechanisms guarding the official Android app store ( including the detection engines of the members of the App Defense Alliance ) and all security vendors participating in the VirusTotal program ( see Figure 1 ) .


DEFENSOR ID was released on Feb 3 , 2020 and last updated to v1.4 on May 6 , 2020 .


The latest version is analyzed here ; we weren ’ t able to determine if the earlier versions were also malicious .


According to its profile at Google Play ( see Figure 2 ) the app reached a mere 10+ downloads .


We reported it to Google on May 16 , 2020 and since May 19 , 2020 the app has no longer been available on Google Play .


The developer name used , GAS Brazil , suggests the criminals behind the app targeted Brazilian users .


Apart from including the country ’ s name , the app ’ s name is probably intended to imply a relationship with the antifraud solution named GAS Tecnologia .


That security software is commonly installed on computers in Brazil as several banks require it to log into their online banking .


However , there is also an English version of the DEFENSOR ID app ( see Figure 3 ) besides the Portuguese one , and that app has neither geographical nor language restrictions .


Playing further off the suggested GAS Tecnologia link , the app promises better security for its users .


The description in Portuguese promises more protection for the user ’ s applications , including end-to-end encryption .


Deceptively , the app was listed in the Education section .


Functionality After starting , DEFENSOR ID requests the following permissions : allow modify system settings permit drawing over other apps , and activate accessibility services .


If an unsuspecting user grants these permissions ( see Figure 4 ) , the trojan can read any text displayed in any app the user may launch – and send it to the attackers .


This means the attackers can steal the victim ’ s credentials for logging into apps , SMS and email messages , displayed cryptocurrency private keys , and even software-generated 2FA codes .


The fact the trojan can steal both the victim ’ s credentials and also can control their SMS messages and generated 2FA codes means DEFENSOR ID ’ s operators can bypass two-factor authentication .


This opens the door to , for example , fully controlling the victim ’ s bank account .


To make sure the trojan survives a device restart , it abuses already activated accessibility services that will launch the trojan right after start .


Our analysis shows the DEFENSOR ID trojan can execute 17 commands received from the attacker-controlled server such as uninstalling an app , launching an app and then performing any click/tap action controlled remotely by the attacker ( see Figure 5 ) .


In 2018 , we saw similar behavior , but all the click actions were hardcoded and suited only for the app of the attacker ’ s choice .


In this case , the attacker can get the list of all installed apps and then remotely launch the victim ’ s app of their choice to either steal credentials or perform malicious actions ( e.g .


send funds via a wire transfer ) .


We believe that this is the reason the DEFENSOR ID trojan requests the user to allow “ Modify system settings ” .


Subsequently , the malware will change the screen off time-out to 10 minutes .


This means that , unless victims lock their devices via the hardware button , the timer provides plenty of time for the malware to remotely perform malicious , in-app operations .


If the device gets locked , the malware can ’ t unlock it .


Malware data leak When we analyzed the sample , we realized that the malware operators left the remote database with some of the victims ’ data freely accessible , without any authentication .


The database contained the last activity performed on around 60 compromised devices .


We found no other information stolen from the victims to be accessible .


Thanks to this data leak , we were able to confirm that the malware really worked as designed : the attacker had access to the victims ’ entered credentials , displayed or written emails and messages , etc .


Once we reached the non-secured database , we were able to directly observe the app ’ s malicious behavior .


To illustrate the level of threat the DEFENSOR ID app posed , we performed three tests .


First , we launched a banking app and entered the credentials there .


The credentials were immediately available in the leaky database – see Figure 6 .


Figure 6 .


The banking app test : the credentials as entered ( left ) and as available in the database ( right ) Second , we wrote a test message in an email client .


We saw the message uploaded to the attackers ’ server within a second – see Figure 7 .


Figure 7 .


The email message test : the message as written ( left ) and as available in the database ( right ) Third , we documented the trojan retrieving the Google Authenticator 2FA code .


Figure 8 .


The software generated 2FA code as it appeared on the device ’ s display ( left ) and as available in the database ( right ) Along with the malicious DEFENSOR ID app , another malicious app named Defensor Digital was discovered .


Both apps shared the same C & C server , but we couldn ’ t investigate the latter as it had already been removed from the Google Play store .


Indicators of Compromise ( IoCs ) Package Name Hash ESET detection name com.secure.protect.world F17AEBC741957AA21CFE7C7D7BAEC0900E863F61 Android/Spy.BanBra.A com.brazil.android.free EA069A5C96DC1DB0715923EB68192FD325F3D3CE Android/Spy.BanBra.A MITRE ATT & CK techniques Tactic ID Name Description Initial Access T1475 Deliver Malicious App


via Authorized App Store Impersonates security app on Google Play .


T1444 Masquerade as Legitimate Application Impersonates legitimate GAS Tecnologia application .


Discovery T1418 Application Discovery Sends list of installed apps on device .


Impact T1516 Input Injection Can enter text and perform clicks on behalf of user .


Collection T1417 Input Capture Records user input data .


Command and Control T1437 Standard Application Layer Protocol Uses Firebase Cloud Messaging for C & C .